Comparing the difficulty of factorization and discrete logarithm: a 240-digit experiment
This work provides empirical evidence for cryptographers and security experts on the relative hardness of two fundamental cryptographic problems, which is incremental but important for assessing encryption security.
The researchers tackled the problem of comparing the computational difficulty of integer factorization and discrete logarithm by performing both tasks on 795-bit numbers, achieving new records for RSA-240 factorization and a discrete logarithm computation, with results showing that discrete logarithm is not significantly harder than factorization at this scale.
We report on two new records: the factorization of RSA-240, a 795-bit number, and a discrete logarithm computation over a 795-bit prime field. Previous records were the factorization of RSA-768 in 2009 and a 768-bit discrete logarithm computation in 2016. Our two computations at the 795-bit level were done using the same hardware and software, and show that computing a discrete logarithm is not much harder than a factorization of the same size. Moreover, thanks to algorithmic variants and well-chosen parameters, our computations were significantly less expensive than anticipated based on previous records.The last page of this paper also reports on the factorization of RSA-250.